At Coinsquare Capital Markets Ltd. (“Coinsquare,” “we,” “us,” or “our”), we take privacy seriously. This Privacy Statement explains how we collect, use, store, transfer, and otherwise process your personal information when you access the Robinhood Canada trading platform, which may be accessed at https://coinsquare.com/ or any of our associated websites and mobile applications (collectively, the "Site"), and use the services we provide via the Site (the “Services”). This includes when you (“user,” “you,” or “your”) are a prospective, current, or former customer.

Our Privacy Statement is our commitment to handle your personal information with care and in accordance with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, An Act Respecting the Protection of Personal Information in the Private Sector (Law 25). We will treat personal information in a manner consistent with this Privacy Statement and our privacy practices, unless we have your consent to treat it differently.

If you agree to the practices outlined in this Privacy Statement on behalf of a business or other legal entity, you represent that you have the authority to accept the terms of this Privacy Statement on behalf of such entity. If you do not have such authority, or if you do not agree with the terms of this Privacy Statement, you may not access or use the Site and Services. This Privacy Statement does not apply to the practices of companies that we do not own or control or to individuals we do not employ or manage.

Coinsquare is responsible for the personal information under our control. We have designated a Chief Privacy Officer who is accountable for our compliance with this Privacy Statement and applicable Canadian privacy laws. All comments, questions, concerns, or complaints regarding your personal information or our privacy practices should be forwarded to our Chief Privacy Officer:

By mail: Coinsquare Capital Markets Ltd. Attn: Chief Privacy Officer 371 Front Street West, Suite 304 Toronto, ON M5V 3S8

By email: privacy@coinsquare.com

If your concern remains unresolved, you have the right to complain to the applicable supervisory authority:

• Office of the Privacy Commissioner of Canada

30 Victoria Street, Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 | Website: www.priv.gc.ca

• For Quebec residents—Commission d'accès à l'information du Québec (CAI)

Website: www.cai.gouv.qc.ca

The term “personal information” means any information that is identifiable with you as an individual. We limit the collection of personal information to that which is necessary for the purposes identified in this Privacy Statement. We collect the following categories of personal information:

• Identity and Contact Data: Your name, date of birth, place of birth, citizenship, email address, mailing address, telephone number, government-issued identification documents (such as a driver’s licence or passport), and data derived from such documents, including facial images and facial geometry for identity verification purposes.
• Financial Data: Your employment information, linked bank account details, payment card information, income, account balances, crypto holdings, CAD value of transactions, quantity of crypto assets or fiat per order, financial transaction history, payment authorization information, order activity history, and tax information (including, where required, your Social Insurance Number). For institutional clients, we also collect tax ID, proof of legal formation, corporate address, and personal identification information for all material beneficial owners and authorized users. If you link your bank account to the Service through a third-party financial data aggregation service, we will receive identity and contact data and transaction information from some or all of the accounts and sub-accounts accessible through the credentials used. This may include your account information, account type, and current account balances.
• Account Data: Account agreements entered into, data about your assets and their origin, generic job title, whether you are a politically exposed person or the family member or close associate of a politically exposed person, whether you or a family member work for another investment dealer, account open date, and dates associated with key account milestones.
• Profile Data: Your username, password, and your interests and preferences as derived from your use of the Services.
• Transactional Data: Transaction amount, type and nature of transactions, time and date, and location data associated with transactions.
• Marketing and Advertising Data: Your marketing preferences and choices, survey responses, and your interactions with our marketing communications.
• Communication Data: Communications with you regarding the Services, including by phone, chat, email, and other means.
• Usage and Device Data: Data about the way you use the Services, including date and time, device identifiers, browser type, operating system, hardware settings, IP address, GPS geolocation data, length of visits, pages viewed, scrolling behaviour, links clicked, language preferences, and referring URLs.
• AI and Chatbot Interaction Data: When you interact with a chatbot or AI feature on our Site or Services, we may collect your input and conversation data to provide a response or further customize our answers to you. Your interactions with a chatbot or AI feature may be reviewed and used for quality assurance and training purposes.
• Inferred Data: We may infer additional information about you based on your interactions with our Services, such as your product interests or preferences.
• Legal Compliance Data: Data obtained in order for us to comply with legal requirements, including data requested by government and tax authorities and required for our anti-money laundering and anti-terrorist financing obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and our obligations to FINTRAC.
• Biometric Data: We extract facial geometry from selfies, photographs, or videos with your express consent to verify your identity and to detect and prevent fraud.

Note on Social Insurance Numbers: We collect your Social Insurance Number (SIN) only where required by law (e.g., tax reporting). Use of SINs for any other purpose is not permitted and we take additional steps to protect this information.

We collect personal information directly from you (for example, when you register, fill out forms, enter orders, or request transfers), and from third-party sources, including:

• Vendors and Business Partners: Service providers who assist with identity verification, fraud prevention, anti-money laundering (AML) checks, and data analytics.
• Financial Account Linking: If you link a financial account, we receive details from the originating financial institution and from third-party financial data aggregation services.
• Publicly Available Sources: Public databases, sanctions lists, and public records to meet our legal obligations.
• Advertising Partners: We may collect information about your interactions with our advertising campaigns on third-party platforms.

Except where otherwise permitted or required by law, we will obtain your informed consent prior to collecting, and in any case prior to using or disclosing, your personal information for any purpose.

The form of consent we seek—whether express or implied—depends on the sensitivity of the personal information, your reasonable expectations in the circumstances, and the purposes for which we are collecting it. Express consent may be obtained verbally, electronically, or in writing. Implied consent may arise through your use of the Services or when you approach us to obtain information, inquire about, or apply to use our Services.

• Sensitive Personal Information (including biometric data, Social Insurance Numbers, government-issued identification, and financial information) will only be collected and used with your express consent, except where otherwise required by law.
• Marketing Communications: We will only send you commercial electronic messages in compliance with Canada’s Anti-Spam Legislation (CASL). You can opt out at any time using the unsubscribe mechanisms provided in each communication.
• Withdrawing Consent: You may withdraw your consent to our processing of your personal information at any time by contacting our Chief Privacy Officer. Please note that withdrawing consent may affect our ability to provide you with some or all of our Services, and may not apply where processing is required by law.

Our primary purpose in collecting personal information is to provide you with a secure, efficient, and customized experience. We only collect and use the personal information necessary to achieve these purposes:

• To properly verify your identity and fulfill our anti-money laundering and anti-terrorist financing obligations with FINTRAC.
• To process your account application, open, manage, and administer your account.
• To determine your eligibility for our Services and the products and services of our affiliates, and to determine their price.
• To process your activity using the Services, including payment transfers, orders, and withdrawals.
• To respond to questions, comments, or concerns regarding Coinsquare.
• To send you marketing communications about our products and services, in compliance with CASL. You may unsubscribe at any time.
• To develop aggregate consumer profiles, perform sales analysis, and identify marketing opportunities and strategies.
• To measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you.
• To collect your opinions and comments regarding Coinsquare's operations.
• To recruit for positions at Coinsquare.
• To maintain legal and regulatory compliance.
• To understand, maintain, develop, and improve the Services through analytics and performance monitoring.
• To investigate legal claims and regulatory inquiries.
• To protect against fraud and/or funds or asset loss.
• To administer our Site and Services.
• To ensure network and information security.
• For such other purposes for which Coinsquare may obtain your consent from time to time.
• For such other uses as may be permitted or required by applicable law.

Automated Decision-Making: Where we use your personal information to make decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects, we will inform you of this use and provide an opportunity to request human review, correct the information used, and submit observations, as required by applicable law. Quebec residents may have additional rights in this regard under Law 25.

Except as set forth in this Privacy Statement or as required or permitted by law, we do not sell your personal information to third parties. We share your personal information only in the circumstances described below:

Some of our service providers and affiliates are located outside of Canada, including in the United States. When your personal information is transferred to a foreign jurisdiction, it is subject to the laws of that jurisdiction and may be disclosed to or accessed by courts, law enforcement, and governmental authorities under those laws. You are welcome to contact our Chief Privacy Officer for further information about our policies regarding service providers outside Canada.

For Quebec Residents: Where personal information is communicated outside Quebec, we conduct a privacy impact assessment to ensure that the information will receive adequate protection under the laws of the receiving jurisdiction, as required by Law 25.

We retain personal information for the duration of your relationship with us and for a period of up to seven (7) years after its conclusion to comply with our legal and regulatory obligations, including under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Different retention periods may apply depending on the specific circumstances and applicable law. We have retention processes designed to ensure personal information is not retained longer than necessary for the purposes identified in this Privacy Statement.

We have implemented reasonable administrative, technical, and physical security measures to safeguard your personal information against theft, loss, and unauthorized access, use, modification, and disclosure. We restrict access to your personal information on a need-to-know basis to employees and authorized service providers who require access to fulfill their job responsibilities.

While we strive to protect your personal information, please be aware that: (i) there are security and privacy limitations of the Internet that are beyond our control; (ii) the security, integrity, and privacy of information exchanged between you and the Site and Services cannot be guaranteed; and (iii) such information may be viewed or tampered with in transit by a third party, despite best efforts.

Privacy Breach Notification: In the event of a security breach that creates a real risk of significant harm to you, we will notify you and report the breach to the Office of the Privacy Commissioner of Canada (and, where applicable, to the CAI for Quebec residents) as required by applicable law.

You have the following rights regarding your personal information, subject to certain legal limitations:

• Right to Access: You have the right to request access to the personal information we hold about you. We will make such information available in a form that is generally understandable and will explain any abbreviations or codes used.
• Right to Correction: You have the right to request the correction of any inaccurate or incomplete personal information. Where we correct information, we will, where appropriate, transmit the correction to third parties who have access to your personal information.
• Right to Withdraw Consent: You may withdraw your consent to our processing of your personal information at any time, subject to legal or contractual restrictions and reasonable notice.

We will attempt to respond to written access or correction requests within thirty (30) days of receipt. We will advise you in writing if we cannot meet this timeline. We will not charge fees to access your personal information without first providing you with an estimate of the approximate costs.

We may request that you provide sufficient identification to confirm your identity before processing a request. Any identifying information provided for this purpose will be used only to fulfill the request.

For Quebec residents, you also have:

• Right to Data Portability: The right to receive your computerized personal information in a structured, commonly used technological format.
• Right to De-indexation: The right to request that we cease disseminating your personal information or de-index any hyperlink attached to your name that provides access to it, under certain conditions.
• Right to Deletion: The right to request that we delete personal information we hold about you. Please note that this request is subject to certain exceptions. For example, we may retain information where required for legal, regulatory, security, or tax reporting purposes.
• Rights regarding automated decision-making: The right to be informed of and to object to decisions made solely through automated processing, and to request human review.

To exercise any of your rights, please contact our Chief Privacy Officer using the contact details in Section 1.

Our Site uses cookies and other data collection technologies to collect certain information about your equipment, browsing actions, and patterns. We use this information to improve the Site, recognize you upon return visits, and serve relevant advertising.

The technologies we use include:

• Browser Cookies: Small files placed on your device. You may refuse cookies by adjusting your browser settings, though this may affect your ability to use certain parts of the Site.
• Flash Cookies: Local stored objects used to collect information about your preferences and navigation. These are not managed by the same browser settings as browser cookies. Visit the Flash player settings page on Adobe's website to manage Flash cookie settings.
• Web Beacons: Small electronic files (also called clear gifs, pixel tags, or single-pixel gifs) used to count users who have visited certain pages and for related website statistics.
• Software Development Kits and Similar Technologies: Software development kits (SDKs) and similar tools used by us and our service providers to collect usage and device information through our mobile applications.

We and some of our third-party partners may use these technologies to collect information about your online activities over time and across third-party websites for behavioral advertising purposes. Third parties, including advertisers, ad networks, and analytics providers, may also use tracking technologies on our Site.

To opt out of interest-based advertising, you may visit:

• Digital Advertising Alliance of Canada Opt-Out Tool
• Network Advertising Initiative Opt-Out Tool

Opting out of a network does not mean you will no longer receive online advertising; it means that the network will no longer deliver ads tailored to your web preferences and usage patterns. You can adjust your cookie preferences (including withdrawing your consent) in relation to non-strictly necessary cookies by using the cookie banner on our Platforms or by using our Consent Management Platform.

If you do not want to accept cookies or want to withdraw your consent, you may also be able to block them by adjusting the settings on your internet browser. Please note that because this is a setting on your browser, this adjustment may also block cookies for any website you visit. You can visit www.aboutcookies.org, and https://allaboutcookies.org/ which provide detailed information on managing cookies in popular browsers.

Our Site may contain links to third-party websites that we do not own or operate. These linked websites have separate and independent privacy policies, which we encourage you to review. We do not have control over such websites and are not responsible for their privacy practices.

You must be of the age of majority in your province or territory of residence to use the Site and Services. We do not knowingly collect personal information from individuals under the age of majority. If you believe that a minor has provided personal information to us, please contact our Chief Privacy Officer to request deletion of that information.

We may update this Privacy Statement from time to time. When we do, we will revise the effective date at the top of this document. For material changes, we will provide notice by posting the updated Statement on our website and app and, where appropriate, by sending you a direct notification. Continued use of the Services following notice of a material change constitutes your acknowledgment of the updated Statement; however, where applicable law requires affirmative consent for material changes to the uses of your personal information, we will obtain that consent before applying the change to your data.